Security audit

Reelclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its reel-production purpose, but it needs review because it can change the host environment, upload videos to public/third-party services, and act on connected social accounts.

Review before installing. Use this only with media you are comfortable sending to Google Gemini, DanSUGC/ScrapCreators, tmpfiles.org, and Post-Bridge. Install ffmpeg and fonts manually from trusted sources, avoid confidential demos unless you have approved storage and privacy handling, and require explicit approval before purchases, public uploads, scheduling, updates, or deletions on social accounts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:74
Finding: Unverified Font Dependency Downloaded from an Unofficial Source
Content: View full analysis
/dev/null && fc-cache -f "$FONT_DIR" echo "TikTok Sans: installed to $FONT_DIR" fi ``` ### Technical Analysis The mandatory preflight procedure downloads a mutable ZIP archive from `cufonfonts.com`, an unofficial third-party font distribution site. The archive is installed without: - A pinned release or immutable artifact URL - A cryptographic checksum - A publisher signature - Validation of archive members before extraction - Validation that the resulting files are genuine TrueType fonts - Explicit user approval before modifying the user's font directory Because the retrieved artifact is not integrity-checked, its effective contents can change after the Skill has been audited. A compromise of the download service, DNS/TLS trust chain, hosting account, or upstream artifact could cause the Skill to install attacker-controlled content. The command also extracts the archive under the shared `/tmp` directory using predictable names and `unzip -o`. This creates additional opportunities for local race conditions or collisions with files created by another local process. This is not a `curl | ba ...[truncated 1938 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:366
Finding: User Video Content Uploaded to Unauthenticated Public Temporary Hosting
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (22)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: The chained privileged install command combines environment detection, package update, and package installation into a single flow that the user is told to run every time. This pattern amplifies the risk of unsafe automation because a content skill can trigger repeated privileged host modifications with little user scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
if command -v brew &>/dev/null; then brew install ffmpeg elif command -v apt-get &>/dev/null; then sudo apt-get update && sudo apt-get install -y ffmpeg else echo "ERROR: Install ffmpeg manually"; exit 1 fi

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

Download using the URLs returned from purchase

bash
curl -L -o hook-clip.mp4 "DOWNLOAD_URL_FROM_PURCHASE"

Hook Selection Rules

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example sends a local video file to a public file-sharing service and prints a public download URL without any privacy, confidentiality, or data handling warning. Given this skill's purpose of creating and scheduling marketing reels at scale, users may process proprietary demos, unreleased campaigns, or personal likenesses, making accidental disclosure significantly more dangerous.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/tools-setup.md (reported line 137)May include surrounding context.
Direct video upload for analysis:

bash
# Step 1: Upload video file FILE_URI=$(curl -s -X POST \ "https://generativelanguage.googleapis.com/upload/v1beta/files?key=$GEMINI_API_KEY" \ -H "X-Goog-Upload-Command: start, upload, finalize" \ -H "X-Goog-Upload-Header-Content-Type: video/mp4" \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's mandatory preflight modifies the host by installing ffmpeg and downloading/installing fonts, including use of sudo on Linux. For a content-production skill, automatic package/font installation expands scope from using declared tools to changing the execution environment, which can introduce supply-chain risk and unexpected privileged side effects.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The preflight step invokes sudo apt-get install, encouraging privileged package installation from inside the skill. Any instruction that normalizes root execution materially increases the blast radius of mistakes, dependency compromise, or command substitution and is unnecessary for a skill that should operate within existing tooling.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
if command -v brew &>/dev/null; then brew install ffmpeg elif command -v apt-get &>/dev/null; then sudo apt-get update && sudo apt-get install -y ffmpeg else echo "ERROR: Install ffmpeg manually"; exit 1 fi

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill fetches a font archive from an external website and installs its contents into the user's font directory. Downloading executable-adjacent assets from a non-official source during runtime introduces supply-chain and integrity risk, especially because the content is not pinned, verified, or manually reviewed.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
fi mkdir -p "$FONT_DIR" cd /tmp curl -L -o tiktoksans.zip "https://www.cufonfonts.com/download/font/tiktok-sans" unzip -o tiktoksans.zip -d tiktoksans_extracted cp tiktoksans_extracted/TikTokSans*.ttf "$FONT_DIR/" rm -rf tiktoksans_extracted tiktoksans.zip

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

Download using the URLs returned from purchase

bash
curl -L -o hook-clip.mp4 "DOWNLOAD_URL_FROM_PURCHASE"

Hook Selection Rules

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Gemini analysis workflow uploads DEMO.mp4 to Google's API without clearly warning that the media leaves the local environment. Demo recordings can contain sensitive product UI, customer data, or unreleased features, so silent transmission to an external AI service presents a real privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The generateContent request sends demo-derived data and references an uploaded video file to an external AI service. In context this is not inherently malicious, but it is dangerous when performed without explicit disclosure because sensitive media and prompts are transmitted off-host to a third party.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
-H "Content-Type: video/mp4" \ --data-binary @"DEMO.mp4" | python3 -c "import sys,json; print(json.load(sys.stdin)['file']['uri'])") curl -s "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-lite-preview:generateContent?key=$GEMINI_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"contents\": [{

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs uploading completed videos to tmpfiles.org to obtain a public URL, which sends user-generated media to an unrelated third-party file-hosting service. This creates unnecessary data exposure and availability risk, especially since the manifest does not declare or justify this external sharing path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The tmpfiles.org upload step lacks any warning that finished videos are being transmitted to and publicly hosted by an external service. Users may unknowingly expose proprietary demos, unreleased campaigns, or personal media, making this a meaningful privacy and confidentiality issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Documenting all ffmpeg commands with unconditional -y causes silent overwrite of existing files, which can destroy local data or replace prior outputs without confirmation. In an automated media pipeline handling many clips and temporary paths, this increases the chance of accidental data loss or clobbering intermediate artifacts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation includes a ready-to-run workflow that uploads a generated local video to a public third-party file hosting service, which expands the skill from local reel production into external data disclosure. In a pipeline that processes user-generated marketing assets, demos, or potentially unpublished content, this creates a real risk of accidental public exposure and uncontrolled data sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The statement "ALL text MUST be placed here" imposes a universal content requirement in natural language, but the file does not contain a language or locale choice issue elsewhere. However, this is not actually a locale policy violation; after review, no clear SQP-3 violation is present.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation exposes a raw proxy capability to arbitrary ScrapCreators endpoints, which materially broadens what the skill can access beyond the stated reel-production workflow. In an agent setting, a generic pass-through tool can be repurposed to query unintended third-party endpoints, expand data collection, and bypass narrower safety assumptions tied to the named analytics helpers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The guide documents tools that can create, update, and delete social media posts on connected external accounts without an explicit warning about the real-world impact of those actions. In an agentic workflow, omission of such warnings increases the chance of accidental publication, deletion, or modification of user content across live accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The raw proxy analytics capability is described without a privacy notice that user-supplied URLs, handles, query parameters, and request bodies may be transmitted to a third-party service. This creates a meaningful privacy and compliance risk because operators may not realize that potentially sensitive input is leaving the local environment and being processed externally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The analytics section explicitly states that arbitrary paths, query parameters, and request bodies are forwarded as-is to an external proxy service. That is a genuine capability expansion and creates a broad exfiltration and misuse surface, because an agent could send user-supplied data, URLs, handles, or payloads to external services without meaningful constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Gemini instructions tell users to upload local video files for remote processing but omit an explicit warning that the media is sent to Google's API. This is a real privacy and data-handling issue, especially if demo recordings contain proprietary interfaces, credentials, personal data, or unreleased product information.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This command transmits a local video file to an external Google endpoint, which is a genuine external data transfer. In the context of a skill that processes app demos, the uploaded file may contain confidential product footage or sensitive on-screen data, making silent transmission risky if not clearly disclosed and consented to.
Content: Scanner excerpt · references/tools-setup.md (reported line 137)May include surrounding context.
Direct video upload for analysis:

bash
# Step 1: Upload video file FILE_URI=$(curl -s -X POST \ "https://generativelanguage.googleapis.com/upload/v1beta/files?key=$GEMINI_API_KEY" \ -H "X-Goog-Upload-Command: start, upload, finalize" \ -H "X-Goog-Upload-Header-Content-Type: video/mp4" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: The generateContent request sends prompts and the previously uploaded file reference to Google's API for remote analysis, which is another external transmission point. While expected for cloud AI usage, it still creates data exposure risk if the prompt or referenced media contains proprietary, personal, or regulated information and the documentation does not warn about that fact.
Content: Scanner excerpt · references/tools-setup.md (reported line 145)May include surrounding context.
md
--data-binary @"DEMO.mp4" | python3 -c "import sys,json; print(json.load(sys.stdin)['file']['uri'])") # Step 2: Analyze curl -s "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-lite-preview:generateContent?key=$GEMINI_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"contents\": [{

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Chaining Abuse

External Script Fetching

Hook Selection Rules

Missing User Warnings

External Script Fetching

Context-Inappropriate Capability

Sudo/Root Execution

External Transmission

External Transmission

Hook Selection Rules

Missing User Warnings

External Transmission

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

External Transmission

External Transmission

Static analysis